
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
dirshare is a HTTP WSGI Python application to rapidly share images within a specific root path, leverages thumbnail caching, instantaneous image resizing, file meta data extraction and zip file creation.
The motivation to create this application is that occasionally I must browse a large collection of photos, WITHOUT a dedicated server software, loading of full sized images or modifying original files.
Note Pillow library uses system libraries to decode specific type of files. If you get "IOError: decoder XXX not available" while loading some images, you're probably missing some libraries (ex. libjpeg).
From PyPI:
pip install dirshare
Or:
python setup.py install
Usage: dirshare [options]
Options:
-h, --help show this help message and exit
-r IMAGES_ROOT, --images-root=IMAGES_ROOT
Root directory to share (default: ".")
-s IMAGE_SIZES, --image-sizes=IMAGE_SIZES
Available sizes as a string (default: "128x128 600x600
1000x1000 full")
-f RESIZE_FORMAT, --resize-format=RESIZE_FORMAT
Resize encoder to use (default: "PNG")
-q RESIZE_QUALITY, --resize-quality=RESIZE_QUALITY
Resize quality value to pass to encoder (default: 90)
-d DB_URI, --db-uri=DB_URI
DB uri (default: "mongodb://localhost:27017/dirshare")
-p HTTP_PORT, --http-port=HTTP_PORT
HTTP listen port (default: 6543)
-b HTTP_IP, --http-ip=HTTP_IP
HTTP bind ip (default: "127.0.0.1")
Example:
dirshare -r /home/myuser -s "128x128 500x500 full" -d "sqlite://:memory:"
updated: _waitForThumbs timeout set to 50ms updated: default view set to grid new: image count badge added to breadcrumb fixed: $scope.setSize was calling cacheSized instead of setImage updated: when image is de/selected, page is scrolled to correct position new: util function to rotate image from string data updated: all watches removed from controller. Actions are now taken inside setter methods. updated: added readyImage flag to check if selected image is preloaded updated: listDir and image requests are now retried when fail fixed: some buttons now Select are now available even if there are no images in current path new: loading image for listDir request added fixed: loading bar was showing wrong values; image cant be changed while previously is being loaded updated: dont allow path changes when isLoading() new: images service. image cache is now controlled in specific service. (code updated to use it) updated: files_paths is now returned from list dir view. updated: variables renamed to camelCase updated: .basket is now a list of full_path's updated: listdir returns 404 when unknown directory updated: $scope.image is a string again, to obey single-source-of-truth ($scope.images) updated: refreshImage() now loads cache when needed; fixed: nav_path doesnt add empty entry when / is last character; updated: buttonsare hidden when loading or no image in current path updated: metadata is no longer created inside stream_image for performance; logging added updated: metadata is only loaded when image is loaded; updated: when page section is changed, deferred received images are discarded updated: images are now structured in an JS object new: preloading thums with progress bar new: previous and next buttons for easy navigation updated: $scope.image is an object now updated: bool variables to control loading created. updated: keypress event captured to handle left and right keys. updated: split app.js into js files updated: manage panel, nav pills used for directories again new: polling routine update: app.js: path variable doesnt allow '//' anymore (should fix Windows problems)
FAQs
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.